How to Decode and Inspect JWT Tokens Online (Free & Private)

JWTs (JSON Web Tokens) are everywhere in modern web authentication — your login session, OAuth tokens, API keys, and service-to-service authentication all commonly use them. But a raw JWT is an opaque string of Base64URL-encoded data. Decoding it reveals the user claims, expiry time, and issuer — essential information for debugging auth issues. Here is how to inspect JWT tokens safely.

What is a JWT?

A JWT is a compact, self-contained token used to securely transmit information between parties as a JSON object. It consists of three parts separated by dots:

• Header — Contains the token type (JWT) and the signing algorithm (HS256, RS256, etc.).
• Payload — Contains the “claims” — statements about the entity (typically the user) and additional metadata. Standard claims includesub (subject/user ID), iss (issuer), exp(expiration time), iat (issued at), and aud (audience). Custom claims can contain any data the issuing application adds.
• Signature — A cryptographic hash of the header and payload, signed with the issuer's secret or private key. This prevents tampering — if any part of the token is modified, the signature becomes invalid.

All three parts are individually Base64URL-encoded and concatenated with dots.

Decoding vs verifying: an important distinction

Decoding is simply reading the Base64URL-encoded content of the header and payload. Anyone can decode a JWT — the payload is not encrypted, just encoded. Decoding reveals the claims inside the token.

Verifying checks the signature to confirm that the token was issued by a trusted party and has not been tampered with. Verification requires the issuer's secret key or public key. You cannot verify a token without this key.

Browser-based JWT decoders only decode — they do not verify the signature (and cannot, without the secret key). For debugging purposes, this is sufficient. For production authentication, always verify JWTs on your server.

Common JWT claims and what they mean

Step-by-step: decoding a JWT with ToolsGravity

1. Open the JWT Decoder and paste your JWT token into the input field. It should start with “eyJ” (the Base64URL encoding of {).
2. The tool automatically splits the token into its three parts and decodes each one.
3. Review the Header to see the algorithm and token type.
4. Review the Payload to see all claims. Check the exptimestamp — the tool should convert it to a human-readable date so you can quickly see if the token has expired.
5. The Signature section shows the raw signature. Remember: the tool can display it but cannot verify it without the secret key.

JWT security best practices

• Never put sensitive data in JWT payloads — The payload is encoded, not encrypted. Anyone who intercepts the token can read it. Never include passwords, full credit card numbers, or other sensitive data in claims.
• Keep expiry times short for access tokens — 15 minutes is a common access token lifetime; refresh tokens can be longer-lived but must be stored securely.
• Always verify on the server — Never trust a JWT just because it decoded successfully. Always verify the signature server-side.
• Use HTTPS — Transmit tokens over HTTPS only. A token intercepted in transit can be used to impersonate the user until it expires.

Summary

JWT decoding is an essential debugging skill for any developer working with modern authentication. The ToolsGravity JWT Decoder splits any JWT into its header, payload, and signature, displaying the claims in human-readable JSON — including converting Unix timestamps to readable dates. Use it for debugging auth issues, checking token expiry, and understanding what your auth system is sending. For JSON-formatted payloads outside JWTs, the JSON Formatter is your companion tool.